ID. Date of interview 
date 93/02/20 


ID. Time interview started 
start 46:53:00 


ID.end Completion date of interview 
Date 3/02/20 


ID.end Time interview ended 
17:07:39 


ID. Duration of interview 
time 14.65 


Start of new case 


Q1 


Does the draft guidance cover the relevant issues about the right of access? 
© Yes 
©) No 

©) Unsure / don't know 

If no or unsure/don’t know, what other issues would you like to be covered in it? 


Q2 


Does the draft guidance contain the right level of detail? 


© Yes 
©) No 

©) Unsure / don't know 

If no or unsure/don't know, in what areas should there be more detail within the draft 
guidance? 


Q3 


Does the draft guidance contain enough examples? 
© Yes 
—) No 

©) Unsure / don't know 

If no or unsure/don’t know, please provide any examples that think should be included in 
the draft guidance. 


Q4 


Q5 


Q6 


Q7 


We have found that data protection professionals often struggle with applying and 
defining ‘manifestly 


unfounded or excessive’ subject access requests. We would like to include a wide 
range of examples 

from a variety of sectors to help you. Please provide some examples of manifestly 
unfounded and excessive 

requests below (if applicable). 


Repeated requests with short periods between them - the requestor is either trying 
to tie up resources or doesn't believe that no data is held/ all data has been 
disclosed Requests that don't give any clue about in what capacity an organisation 
might hold information - eg councils that provide many services, it is hugely 
impractical to search every single service when the requestor is interested in care 
records or communications about highways, rights of way or boundaries. 


On a scale of 1-5 how useful is the draft guidance? 


3— 
1-Notatall 2- Slightly Moderately 4-—Very 5- Extremely 


useful useful useful useful useful 


© 


Why have you given this score? 
It's largely clear and explanatory 


To what extent do you agree that the draft guidance is clear and easy to understand? 


Strongly Neither agree Strongly 
disagree Disagree nor disagree Agree agree 


© 


Q8 Please provide any further comments or suggestions you may have about the draft 
guidance. 


I have a significant issue in the assertion that the clock continues to run while 
waiting for clarification from a requestor. In many authorities there are a range of 
services that an individual could have engaged with, and it is rare for someone who 
says "give me everything" to mean actually everything. In the FE sector they 
probably don't mean every library loan they've had, but that would fall within the 
definition of "everything". Equally, a person who's interest is with social services 
probably doesn't actually also want emails about extra waste collections or parking if 
they say "everything". Sometimes there are assumptions that all data is held on one 
central location or on one system or database. This is very unlikely to be the case. 

It feels as though the block on suspending the clock while waiting for clarification is 
based on an assumption that requestors are both always clear in their requests and 
that all systems are easy to navigate and every individual will have had one entry 
point for one service and is uniquely identifiable. In my 10 years of experience I 
can tell you that this is rarely the case, if ever. Even relatively simple requests from 
former employees will have HR, pay and health and safety records as a minimum. 


Q9 Are you answering as: 
C) An individual acting in a private capacity (eg someone providing their views as a member of the public) 
©) An individual acting in a professional capacity 
`) On behalf of an organisation 
(C) Other 
Please specify the name of your organisation: 
The University of East Anglia 
What sector are you from: 
HE/FE 


Q10 How did you find out about this survey? 
( `) ICO Twitter account 
(`) ICO Facebook account 
(`) ICO LinkedIn account 
(`) ICO website 
( `) ICO newsletter 
(_) ICO staff member 
(`) Colleague 
( ) Personal/work Twitter account 
( ) Personal/work Facebook account 
|) Personal/work LinkedIn account 
( ) Other 
If other please specify: 


